Playbook advisor

advisor lets a model read your signals and propose one of the playbooks you declared, with a reason. A person approves. It is off unless declared, and it never runs on the request path.

advisor:
  on: [attack.suspected, anomaly.detected]
  may: [attack.contain, pressure.slim]
  run: approve
  model: anthropic/claude-sonnet-4-5   # optional; the first of ai.models by default
  feature: advisor                     # the ai feature its calls are made under

import { advisor } from "mainsdk/experimental/advisor";

const p = await advisor.propose();
console.log(p.choice, p.reason, p.evidence);

advisor:
  driver: builtin

Quick start

advisor:
  on: [attack.suspected, anomaly.detected]
  may: [attack.contain, pressure.slim]
  run: approve
agents:
  advisor: { budget: { spend: $2/day, calls: 50/day } }

import { advisor } from "mainsdk/experimental/advisor";

const p = await advisor.propose();
console.log(p.choice, p.reason, p.evidence);

Configuration

What you get

Server only.

A proposal with a choice starts a playbook run with source advisor, held for approval unless run: auto applies.

Always:

• Chooses only from declared playbooks, or none.
• Never approves, and approval is the default.
• Sees signals and norms only, redacted, under 16 KB. It never sees logs, request content, app data, config values, secrets or user identifiers.
• Calls the model through ai as agent advisor, so the model allowlist, region, budget and audit apply.

Examples

With ai.driver: local, replies come from the scripted fixture you give the test app:

import { createTestApp } from "@mainsdk/testing";

const app = await createTestApp({
  ai: { replies: [JSON.stringify({ choice: "attack.contain", reason: "Many failed sign-ins", evidence: ["s1"], confidence: 0.8 })] },
});
const p = await app.advisor.propose();   // evidence aliases s1..sN map back to real signal ids

Errors and checks

Each code's cause and fix is in check codes.

Swapping drivers

The advisor asks whichever ai driver the app uses. Proposals are kept in memory (the last 200); the playbook run they start is durable.

Testing

With ai.driver: local the advisor runs offline on the scripted reply and the fake clock, so a simulated attack gives the same proposals every time and makes no outbound connection. See Test your app.

Security and privacy

• The model sees only redacted signals and norms, never logs, app data, config values, secrets or user identifiers.
• It cannot approve, revert, change a rule or name a step.
• Calls run under the advisor agent's budget and the ai allowlist and region.

Next

• AI
• Playbooks